711d9315d5158ff4fa3577fe80af3d8401f6be6ef735e31784afa8569f0ee945

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 08:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
711d9315d5158ff4fa3577fe80af3d8401f6be6ef735e31784afa8569f0ee945.exe
Size 616KB
Sample260806-kt4cks11fs
SHA256 711d9315d5158ff4fa3577fe80af3d8401f6be6ef735e31784afa8569f0ee945
MD5 61f4b056404b1ef31146f72bea06620b
SHA1 bc2e1b4ca810c95041e7789d7cc86952923f1002
SHA512 2142e71675cd89d7a4c69efbe2b9fa16399b9206c3cbd6f7db35299701c0ca10789f78fab1e65c6fb24d7dacaf476a184fab845af04f39f17cc6fe49344901fa
SSDEEP 6144:9lGDukHgqehOEUbBgH1onbVhm3gBC1OUdK8N+VQs7PlWlBjPKXPXwboCTms51t1I:rqj81OYKPlWlBjifyPTmfWqfO
TLSH
T110D48D619DF0D418EC3AD6F0AABB55319F015673D6671BB4828630AFCBB146F2C9838D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2352	3480	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	711d9315d5158ff4fa3577fe80af3d8401f6be6ef735e31784afa8569f0ee945.exe

C:\Users\Admin\AppData\Local\Temp\711d9315d5158ff4fa3577fe80af3d8401f6be6ef735e31784afa8569f0ee945.exe
"C:\Users\Admin\AppData\Local\Temp\711d9315d5158ff4fa3577fe80af3d8401f6be6ef735e31784afa8569f0ee945.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 264
  2⤵
  - Program crash
  PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3480 -ip 3480
1⤵
PID:1976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3480-0-0x0000000000400000-0x000000000049F000-memory.dmp

Download